version: '3'

services:
  traefik:
    image: traefik:v3.6.5
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - exposed
    ports:
      - 7080:80
      - 7443:443
    environment:
      - HETZNER_API_TOKEN=${HETZNER_API_TOKEN}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${PROJECT_PATH-$PWD}/traefik.yml:/traefik.yml:ro
      - ${PROJECT_PATH-$PWD}/config.yml:/config.yml:ro
      - traefik-certs:/certs
    labels:
      traefik.enable: true

      traefik.http.routers.traefik-secure.entrypoints: https
      traefik.http.routers.traefik-secure.rule: Host(`traefik.arpa.urmel.de`)
      traefik.http.routers.traefik-secure.tls: "true"
      traefik.http.routers.traefik-secure.tls.certresolver: hetzner
      traefik.http.routers.traefik-secure.service: api@internal
      traefik.http.routers.traefik-secure.middlewares: traefik-auth@docker


      traefik.http.routers.traefik-secure.tls.domains[0].main: "arpa.urmel.de"
      traefik.http.routers.traefik-secure.tls.domains[0].sans: "*.arpa.urmel.de"

      traefik.http.middlewares.traefik-auth.basicauth.users: "${AUTH_STRING}"

volumes:
  traefik-certs:

networks:
  exposed: